php escape problem

1,024 Posts

Frank Reply #1, 15 years, 10 months ago

Hi,

I know it s not directly modx related, however I use following to modify text via a form on a Modx site. But the moment backticks are used I get MySQL errors. I understand the real escape thing to little. Can someone point out the error?

<?php 
ob_start("ob_gzhandler");



$idcomp          = $_POST['idcomp'];
$compchar        = $_POST['compchar'];
$Composer      = $_POST['Composer'];
$fname           = $_POST['fname'];
$lname           = $_POST['lname'];
$Birth           = $_POST['Birth'];
$Nationality     = $_POST['Nationality'];
$Opus            = $_POST['Opus'];
$Publisher       = $_POST['Publisher'];
$Oddities        = $_POST['Oddities'];
$information     = $_POST['information'];
$submit          = $_POST['submit'];


$Composer     = str_replace("'", "\'", $Composer);
$fname          = str_replace("'", "\'", $fname);
$lname          = str_replace("'", "\'", $lname);
$Birth          = str_replace("'", "\'", $Birth);
$Nationality    = str_replace("'", "\'", $Nationality);
$Opus           = str_replace("'", "\'", $Opus);
$Publisher      = str_replace("'", "\'", $Publisher );
$Oddities       = str_replace("'", "\'", $Oddities);
$information    = str_replace("'", "\'", $information );


include('connections.php');

//$compchar = $_GET['compchar']; 

// get the actual date and time

$Tdate = getdate();

$entrydate = $Tdate["year"]."-".$Tdate["mon"]."-".$Tdate["mday"]." ".

             $Tdate["hours"].":".$Tdate["minutes"].":".$Tdate["seconds"];





//$newidcomp = $numrows + 1;





// 001: Database insert query


$query = "update quartets set Composer='".$Composer."',".

         "fname='".$fname."',".
         "lname='".$lname."',".
         "Birth='".$Birth."',".
         "Nationality='".$Nationality."',".
         "Opus='".$Opus."',".
         "Publisher ='".$Publisher ."',".
         "Oddities='".$Oddities."',".
			"information ='".$information."' ".
         "where idcomp=".$idcomp;









echo "<br>mod quartets query = " . $query;



// 002: Execute query


$res = mysql_query($query, $sqlConn);
//echo "$res = mysql_query($query, $sqlConn)";




if (!$res)

{

   echo $query;

   die ('Could not run query: ' . mysql_error());

}



mysql_freeresult($res);


mysql_close($sqlConn);


// everything went ok, so we can inform the user


$URL="/index.php?id=2&compchar=".$compchar;
header ("Location: $URL");



mysql_close($sqlConn);


echo("<p>Modifications have been stored</p>")

?>

630 Posts

esche Reply #2, 15 years, 10 months ago

I understand the real escape thing to little. Can someone point out the error?

But where is error text (echo mysql_error();)?

Why not to use addslashes() or mysql_escape_string? (or in php5 filter_input_array)

Правильно заданный вопрос повышает вероятность получения нужного ответа.
Что-то не работает? Загляните в лог ошибок!
Есть проблема? "Локализуйте" её!
Ответы на большинство вопросов по MODx | MODx RTFM | API Evo Revo | галопом по ~~Европам~~ Азиям

wikibooks(ru) Ditto(en) | Wayfinder e-book | Заметки и о MODx

1,024 Posts

Frank Reply #3, 15 years, 10 months ago

But where is error text (echo mysql_error();)?

good question, where should that be?

As for the mysql escape or addslashes, I m not sure where to put these.
This is stuff I pasted together, it works, untill one uses a "’".

not sure how to use what you suggested:

this

$Composer          = $_POST['Composer'];

to this

$Composer= mysql_real_escape_string($_POST['Composer']);

and

$information    = "'", "\'", $information );

to

$information    = mysql_real_escape_string(str_replace("'", "\'", $information ));

Changes this input Diet’er Acker into Diet\\\\’er Acker

630 Posts

esche Reply #4, 15 years, 10 months ago

Quote from: Frank at Dec 12, 2010, 07:02 AM

good question, where should that be?

But the moment backticks are used I get MySQL errors.

I don’t know, where you have found it

$Composer          = $_POST['Composer'];
$Composer     = str_replace("'", "\'", $Composer);

~eq

$Composer          = addslashes($_POST['Composer']);

But it seems, your server php_value magic_quotes_gpc is on, and you don’t need to escape values. Try without escaping
or use addslashes and add in .htaccess this line:

php_value magic_quotes_gpc off

Правильно заданный вопрос повышает вероятность получения нужного ответа.
Что-то не работает? Загляните в лог ошибок!
Есть проблема? "Локализуйте" её!
Ответы на большинство вопросов по MODx | MODx RTFM | API Evo Revo | галопом по ~~Европам~~ Азиям

wikibooks(ru) Ditto(en) | Wayfinder e-book | Заметки и о MODx

1,024 Posts

Frank Reply #5, 15 years, 10 months ago

Thanks, I saw indeed that magic_quotes_gpc is on

In the code there was this:

$array    = str_replace("'", "\'", $array );

I got rid of it and all is fine it seems.
Is this script vulnerable?

<?php 
ob_start("ob_gzhandler");
$idcomp          = $_POST['idcomp'];
$compchar        = $_POST['compchar'];
$Composer     	  = $_POST['Composer'];
$fname           = $_POST['fname'];
$lname           = $_POST['lname'];
$Birth           = $_POST['Birth'];
$Nationality     = $_POST['Nationality'];
$Opus            = $_POST['Opus'];
$Publisher       = $_POST['Publisher'];
$Oddities        = $_POST['Oddities'];
$information     = $_POST['information'];
$submit          = $_POST['submit'];

include('connections.php');

// get the actual date and time

$Tdate = getdate();
$entrydate = $Tdate["year"]."-".$Tdate["mon"]."-".$Tdate["mday"]." ".
             $Tdate["hours"].":".$Tdate["minutes"].":".$Tdate["seconds"];
// 001: Database insert query
$query = "update quartets set Composer='".$Composer."',".
         "fname='".$fname."',".
         "lname='".$lname."',".
         "Birth='".$Birth."',".
         "Nationality='".$Nationality."',".
         "Opus='".$Opus."',".
         "Publisher ='".$Publisher ."',".
         "Oddities='".$Oddities."',".
			"information ='".$information."' ".
         "where idcomp=".$idcomp;

//this correct here?

echo mysql_errno($link) . ": " . mysql_error($link) . "\n";
echo "<br>mod quartets query = " . $query;
// 002: Execute query
$res = mysql_query($query, $sqlConn);

if (!$res)
{
   echo $query;
   die ('Could not run query: ' . mysql_error());
}
mysql_freeresult($res);
mysql_close($sqlConn);
// everything went ok, so back to list page
$URL="/index.php?id=2&compchar=".$compchar;
header ("Location: $URL");
mysql_close($sqlConn);
echo("<p>Modifications have been stored</p>")
?>

1,024 Posts

Frank Reply #6, 15 years, 10 months ago

Hi all,

ongoing PHP questions.
I have a form that allows new items to be addedd, here nationality is picked by a dropdown publishersby a dropdown that is populated from another table.
Then there is a second form that allows items to be modified, here s the same dropdown of countries, but how can I have the option select value default to the value that is in the database. Same for the "publisher" default value?